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REMARKS 

Claims 1-3, 7, 8, and 11 are currently pending, wherein claim 3 has been amended. 
Favorable reconsideration is respectfully requested in view of the remarks presented herein 
below. 

In paragraph 4 of the Office action ("Action"), the Examiner rejects claim 3 under 35 
U.S.C. 112, second paragraph, as being indefinite because there is insufficient antecedent basis 
for the phrase "the instruction code group." Claim 3 has been amended to address the 
Examiner's concerns. Reconsideration and withdrawal of the rejection under 35 U.S.C. 112, 
second paragraph is respectfully requested. 

In paragraph 5 of the Action, the Examiner rejects claims 1-3, 7, 8, and 11 under 35 
U.S.C. § 103(a) as being unpatentable over U.S. Patent No. 6,301,699 to Hollander et al. 
("Hollander") in view of U.S. Patent Application Publication No. 2001/0011346 Al to Yoshimi 
("Yoshimi"). Applicant respectfully traverses this rejection. 

In order to support a rejection under 35 U.S.C. § 103, the Examiner must establish a 
prima facie case of obviousness. To establish a prima facie case of obviousness three criteria 
must be met. First, there must be some rationale to combine the cited references. Second, there 
must be a reasonable expectation of success. Finally, the combination must teach each and every 
claimed element. In the present case, presently pending claims 1-3, 7, 8, and 11 are patentable 
over the combination of Hollander and Yoshimi because the combination fails to disclose each 
and every claimed element as discussed below. 

Claims 1, 2, 3, 7, 8, and 1 1 each recite, inter alia, concluding that the input data includes 
a malicious process if the stored call destination address is between the branch origin address and 
the branch destination address. In other words, the claimed invention concludes that the 
instruction codes within the received input data include a malicious process if it is determined 
the destination address of a forward branch instruction is a call instruction and the address of the 
call instruction is located between the branch origin address and the branch destination address. 

Hollander discloses a method/process that intercepts a called function and performs a 
process of detecting an attempt to exploit a buffer overflow weakness, according to step 102 of 
Fig. 4A. This process is illustrated in detail by Fig. 5 of Hollander, and includes an analysis of 
code to determine execution paths and invalid jump instructions. However, nowhere in 
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Hollander is there any disclosure or suggestion of determining whether the data includes 
instructions for a forward branch where the destination address of the forward branch is 
associated with a call instruction whose destination address is between the origin and destination 
address of the branch instruction as claimed. 

Yoshimi discloses a branch prediction method that predicts/detects forward and backward 
branches. However, Yoshimi, like Sakai and Hollander, fails to disclose detecting/determine 
whether the destination address of a forward branch is associated with a call instruction, where 
the destination address of the call instruction is between the origin and destination of the branch 
instruction as claimed. 

Since Hollander and Yoshimi each fail to disclose or suggest concluding that the input 
data includes a malicious process if the stored call destination address is between the branch 
origin address and the branch destination address as claimed, the combination of these two 
references cannot possibly disclose or suggest said element. Therefore, even if one skilled in the 
art had some rationale to combine Hollander, and Yoshimi (which Applicant does not concede), 
the combination would still fail to render claims 1, 2, 7, and 8 unpatentable because the 
combination fails to disclose each and every claimed element. 

Claims 3 and 11 depend from independent claims 2 and 1, respectively. Accordingly, 
claims 3 and 1 1 are patentable over the combination of Sakai, Hollander, and Yoshimi for at 
least those reasons presented above with respect to claims 2 and 1. Reconsideration and 
withdrawal of the rejection of claims 1-3, 7, 8, and 11 is respectfully requested. 

In response to Applicant's arguments, the Examiner asserts that Hollander teaches 
determining whether or not the read data is a branch instruction and if it is a branch instruction 
determining whether a branch destination address of the branch instruction is larger than a 
branch origin address as claimed because Hollander teaches "read input data is not a branch 
instruction" (See page 3 of the Action). To support this assertion, the Examiner asserts that an if 
conditional exhibits alternative steps in the event the if condition fails, those alternative steps 
including not performing any step. Therefore, the Examiner appears to be basing his rejection on 
the assertion that the limitations of "detennining whether a branch destination address of the 
branch instruction is larger than a branch origin address" is an optional limitation because it is 
preceded by an "if conditional. The Examiner makes similar assertions regarding other claimed 
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limitations which are absent in the cited prior art. The Examiner's assertion has no legal or 
factual basis. It is well accepted that in order to support a rejection under 35 U.S.C. § 103(a) the 
applied combination must teach each and every claimed element. The fact that a claimed 
element includes a conditional statement does not render the claimed element optional. 

The application is in condition for allowance. Notice of same is earnestly solicited. 
Should there be any outstanding matters that need to be resolved in the present application, the 
Examiner is respectfully requested to contact Penny Caudle Reg. No. 46,607 at the telephone 
number of the undersigned below, to conduct an interview in an effort to expedite prosecution in 
connection with the present application. 

If necessary, the Director is hereby authorized in this, concurrent, and future replies to 
charge any fees required during the pendency of the above-identified application or credit any 
overpayment to Deposit Account No. 02-2448. 

Dated: June 7,2010 Respectfully submitted, 
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